In this demo, we're going to discuss how to implement appropriate rule sources.
We'll conduct an evaluation in this demo to determine
which rule sources are appropriate.
We have the following goals from Globomantics in our evaluation.
First, we need to evaluate the external open‑source rule sources.
We need to to find rules that can help us detect the potential
use of common hacking tools and enforce internal access
attempts of unauthorized external sites.
Once we finish our evaluation,
we need to select the appropriate additional sources to apply in the next demo.
Let's head over to our Suricata server and get started.
To obtain the list of sources,
let's first update our source list using the command
sudo suricata‑update update‑sources.
Once that's complete, we can list our sources using list‑sources.
Our focus is on open‑source rule sets.
So,
we'll evaluate sources with a GPL or MIT license that allows
us to use them without a subscription.
From this list, we have the emerging threats open rule set we already installed.
We have a trafficid rule set from OISF, an aggressive IP blacklist from Etnetera,
and a threat‑hunting rule set from Travis Green.
Let's start by evaluating the Etnetera aggressive IP list.
Here's the rules listed on the URL where our Suricata
server would obtain these from.
This appears to be a list of IP addresses to alert against.
Any traffic matching these IPs will generate an alert.
These hosts are known aggressive IP addresses.
So,
we could add this list to detect activity from any of
these IPs targeted at our network.
This could be useful in a normal environment.
But for our lab, this will be difficult to test.
We'll pass on this rule source for our environment and
continue evaluating for other open‑source rules.
Let's look at the threat hunting rules.
These rules are used to detect potential threats in network traffic.
Some of the rules, like these here,
are used to detect the presence of Metasploit.
That makes this the perfect rule set for detecting
potential threats from these tools.
We have one more set to evaluate, the trafficid rules.
These rules are used to detect popular traffic destinations like Facebook,
Google, Netflix, and Snapchat.
We could potentially use these rules to enforce our internal policies,
like allowing access to Google, but preventing access to Netflix,
Snapchat, WhatsApp, and Facebook.
In our environment,
we're trying to control internal policies and at least prevent attacks
using common hacking tools against any vulnerable services.
To accomplish this,
the trafficid rules look useful for controlling our internal
policies, and the hunting rules look promising for detecting
potential threats using popular hacking tools.
We'll explore activating these two rule sources in the next demo
and downloading the rule sets from each one so we can evaluate the
impact to our environment. For now,
determining that these rule sources are appropriate
satisfies our security goals from Globomantics.